skills/paulrberg/agent-skills/vitest/Gen Agent Trust Hub

vitest

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the nlx command to execute the vitest test runner. This is a standard and expected behavior for a testing-focused skill designed to run unit and integration tests within a development environment. Examples include nlx vitest run and nlx vitest --clearCache found in SKILL.md and references/troubleshooting.md.
  • [INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface by ingesting and processing untrusted data from the repository, such as source code, test files, and configuration files.
  • Ingestion points: Reads project files including package.json, vitest.config.ts, and *.test.ts/tsx files as specified in SKILL.md (Workflow Step 1) and references/troubleshooting.md (Tests not found section).
  • Boundary markers: None explicitly defined to separate instructions from data, which is typical for code-processing skills.
  • Capability inventory: Executes shell commands via nlx vitest as documented in SKILL.md (Workflow Step 5).
  • Sanitization: None detected for processed file content, as the tool is intended to execute the code provided in the repository.
  • Assessment: While the surface exists, it is inherent to the primary purpose of writing and running tests. The instructions emphasize following repository conventions and using narrow commands, which limits the likelihood of the agent following arbitrary instructions embedded in code.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 05:05 PM
Security Audit — agent-trust-hub — vitest